I'm trying to reverse engineer a .NET DLL file using dnSpy, and I've encountered a method that decompresses and decrypts a file into an XML string. The relevant code snippet is:
<Module>.DataZipCompression.LoadString(
<Module>.?A0xdbfabc02.g_pDataZipCompression,
ref basic_string<wchar_t, std::char_traits<wchar_t>, std::allocator<wchar_t>>,
ref basic_string<char, std::char_traits<char>, std::allocator<char>>,
true
);
Full fragment:
basic_string<char,std::char_traits<char>,std::allocator<char>\u0020> basic_string<char,std::char_traits<char>,std::allocator<char>_u0020>;
<Module>.std.basic_string<char,std::char_traits<char>,std::allocator<char>\u0020>.{ctor}(ref basic_string<char,std::char_traits<char>,std::allocator<char>_u0020>);
try
{
<Module>.DataZipCompression.LoadString(<Module>.?A0xdbfabc02.g_pDataZipCompression, ref basic_string<wchar_t,std::char_traits<wchar_t>,std::allocator<wchar_t>_u0020>4, ref basic_string<char,std::char_traits<char>,std::allocator<char>_u0020>, true);
byte[] array3 = new byte[<Module>.std.basic_string<char,std::char_traits<char>,std::allocator<char>\u0020>.length(ref basic_string<char,std::char_traits<char>,std::allocator<char>_u0020>)];
for (int i = 0; i < array3.Length; i++)
{
sbyte* ptr3 = <Module>.std.basic_string<char,std::char_traits<char>,std::allocator<char>\u0020>.[](ref basic_string<char,std::char_traits<char>,std::allocator<char>_u0020>, (uint)i);
array3[i] = (byte)(*ptr3);
}
UTF8Encoding utf8Encoding = new UTF8Encoding();
string @string = utf8Encoding.GetString(array3);
XmlDocument xmlDocument = new XmlDocument();
xmlDocument.LoadXml(@string);
dataContainerProperties = genericSerializer.FromXmlStringIgnoreParentName(xmlDocument.OuterXml);
}
catch
{
<Module>.___CxxCallUnwindDtor(ldftn(std.basic_string<char,std::char_traits<char>,std::allocator<char>\u0020>.{dtor}), (void*)(&basic_string<char,std::char_traits<char>,std::allocator<char>_u0020>));
throw;
}
<Module>.std.basic_string<char,std::char_traits<char>,std::allocator<char>\u0020>.{dtor}(ref basic_string<char,std::char_traits<char>,std::allocator<char>_u0020>);
After this line executes, a decompressed and decrypted XML string appears in memory. My goal is to understand the algorithm used in DataZipCompression.LoadString so I can replicate the decryption and decompression process outside of the DLL.
What I've Tried:
- Decompiled the DLL using dnSpy to locate the DataZipCompression class and LoadString method.
- Analyzed the method's parameters and return values.
- Attempted to trace the flow of data through the method.